""ET CURRENT_EVENTS [TW] EvilProxy AiTM Network Reporting""

SID: 2037862

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2022_07_29, deployment Perimeter, signature_severity Major, updated_at 2022_07_29

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "Server|3a 20|nginx/"

  • Value: "|0d 0a|access-control-allow-origin|3a 20 2a 0d 0a|"

  • Value: "|0d 0a|Report-To|3a 20 7b 22|group|22 3a 22|network-errors|22 2c 22|max_age|22 3a|86400|2c 22|endpoints|22 3a 5b 7b 22|url|22 3a 22|"

  • Value: "/api/report?catId=GW+estsfd+"

Within:

PCRE:

Special Options:

  • fast_pattern

source